Repository navigation
ci: publish to npm through trusted publishing with staged releases - #525
Merged
Merged
Conversation
The 2.0.0 publish failed with E404 because NPM_TOKEN expired. Publish through the trusted publisher instead, which allows only `npm stage publish`: - Install npm 11; the runner's npm 10 cannot do the OIDC exchange. - Replace `npm publish` and NODE_AUTH_TOKEN with `npm stage publish`. Trusted publishing adds provenance itself. - Add a workflow_dispatch trigger with a tag input, to publish a tag whose release already exists (v2.0.0).
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 2.0.0 publish job failed twice with
E404 Not Found - PUT https://registry.npmjs.org/libscope(run 37831881935).NPM_TOKENwas last set on 2026-03-01 and has expired. 2.0.0 is tagged and released on GitHub but not on npm.Change
The npm trusted publisher for this repo is now configured for
release-please.ymlwith onlynpm stage publishallowed. This PR switches the publish job to match:npm install -g npm@11: the runner's npm 10.9.9 does not do the OIDC exchange, andnpm stage publishneeds npm >= 11.15.0.npm publish --provenance --access publicwithNODE_AUTH_TOKEN→npm stage publish. Trusted publishing adds provenance itself.workflow_dispatchtrigger with a requiredtaginput. The publish job checks out that tag, so an existing release can be published.After merge
gh workflow run release-please.yml -R RobertLD/libscope -f tag=v2.0.0gh secret delete NPM_TOKEN -R RobertLD/libscopeNot verified
workflow_dispatchrun. npm checks the repo and workflow file name.Either failure would stop at npm before anything goes live.